Hackers Using ELECTRICFISH Malware to Steal Data

Hidden Cobra, also known as Lazarus Group and Guardians of Peace, is believed to be backed by North Korean government and known to launch cyber attacks against media organizations, aerospace, financial and critical infrastructure sectors across the world.

The DHS and the FBI have uncovered a new malware variant, dubbed ELECTRICFISH, that Hidden Cobra hackers have been using for secretly tunneling traffic out of compromised computer systems.

According to the MAR AR19-129A advisory released on US-CERT’s website, the malware was detected while tracking the malicious activities of the North Korean-backed hacking group.

As further detailed in the ELECTRICFISH advisory:

This MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended mitigation techniques. Users or administrators should flag activity associated with the malware and report the activity to the Cybersecurity and Infrastructure Security Agency (CISA) or the FBI Cyber Watch (CyWatch), and give the activity the highest priority for enhanced mitigation.

The malware implements a custom protocol configured with a proxy server/port and proxy username and password, allowing hackers to bypass the compromised system’s required authentication to reach outside of the network.

The ElectricFish malware is a command-line utility whose primary purpose is to quickly funnel traffic between two IP addresses.

The malware allows Hidden Cobra hackers to configure with a proxy server/port and proxy username and password, making it possible to connect to a system sitting inside of a proxy server, which allows the attackers to bypass the infected system’s required authentication.

“It will attempt to establish TCP sessions with the source IP address and the destination IP address. If a connection is made to both the source and destination IPs, this malicious utility will implement a custom protocol, which will allow traffic to rapidly and efficiently be funneled between two machines,” the alert reads.

“If necessary, the malware can authenticate with a proxy to be able to reach the destination IP address. A configured proxy server is not required for this utility.”

The report published on the US-CERT website comes with a detailed analysis of one malicious 32-bit executable file found to be infected with Lazarus’ ELECTRICFISH malware.

Once ElectricFish authenticates with the configured proxy, it immediately attempts to establish a session with the destination IP address, located outside of the victim network and the source IP address. The attack would use command prompts to specify the source and destination for tunneling traffic.

Full analysis for the ELECTRICFISH sample as well as a full list of IOCs are available within the AR19-100A advisory. The IOCs can also be downloaded as an XML document from HERE.